Ransomware Filtering and Recovery Consulting Minneapolis
Ransomware Recovery: An Example
Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that presents an enterprise-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to inflict damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as daily as yet unnamed newcomers, not only perform encryption of online data files but also infect all configured system restores and backups. Files replicated to off-premises disaster recovery sites can also be encrypted. In a poorly architected system, it can render automated restore operations useless and effectively knocks the network back to square one.
Recovering services and information following a ransomware attack becomes a sprint against the clock as the targeted organization tries its best to contain the damage, eradicate the crypto-ransomware, and resume enterprise-critical activity. Because ransomware requires time to replicate throughout a targeted network, assaults are often launched at night, when successful attacks typically take longer to uncover. This multiplies the difficulty of promptly assembling and orchestrating a capable response team.
Progent makes available an assortment of support services for securing Minneapolis businesses from ransomware events. These include team member training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to identify and quarantine zero-day modern malware attacks. Progent also offers the assistance of experienced crypto-ransomware recovery professionals with the track record and commitment to rebuild a breached network as quickly as possible.
Progent's Ransomware Recovery Services
After a ransomware penetration, sending the ransom in cryptocurrency does not guarantee that cyber criminals will provide the codes to decrypt any of your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to re-install the critical elements of your IT environment. Absent the availability of complete system backups, this requires a broad range of IT skills, top notch project management, and the willingness to work non-stop until the task is completed.
For decades, Progent has provided certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned top certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of expertise gives Progent the skills to efficiently determine important systems and consolidate the remaining pieces of your computer network system following a ransomware penetration and assemble them into a functioning network.
Progent's ransomware team uses best of breed project management systems to orchestrate the complex restoration process. Progent knows the importance of working rapidly and in unison with a client's management and IT team members to assign priority to tasks and to get key applications back on line as soon as humanly possible.
Case Study: A Successful Crypto-Ransomware Intrusion Response
A business engaged Progent after their company was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, suspected of adopting technology exposed from America's National Security Agency. Ryuk goes after specific businesses with limited ability to sustain disruption and is one of the most profitable examples of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area and has around 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the intrusion and were damaged. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end called Progent.
Progent worked with the customer to quickly get our arms around and prioritize the essential applications that needed to be recovered in order to continue business functions:
- Windows Active Directory
- Microsoft Exchange
- Accounting/MRP
Within two days, Progent was able to restore Active Directory to its pre-virus state. Progent then charged ahead with setup and storage recovery on needed systems. All Exchange ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on user PCs and laptops in order to recover email data. A recent off-line backup of the businesses financials/MRP software made it possible to recover these required applications back on-line. Although a lot of work remained to recover completely from the Ryuk virus, core services were recovered quickly:
Throughout the next few weeks key milestones in the restoration project were completed in tight cooperation between Progent team members and the client:
- In-house web sites were brought back up with no loss of data.
- The MailStore Server containing more than four million historical emails was brought online and accessible to users.
- CRM/Product Ordering/Invoices/AP/AR/Inventory Control functions were fully recovered.
- A new Palo Alto Networks 850 security appliance was brought on-line.
- Nearly all of the user workstations were back into operation.
Conclusion
A potential business extinction disaster was avoided by results-oriented professionals, a wide range of technical expertise, and tight teamwork. Although in hindsight the ransomware virus incident detailed here should have been prevented with up-to-date security systems and NIST Cybersecurity Framework best practices, staff training, and well thought out security procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, remember that Progent's team of professionals has substantial experience in ransomware virus defense, cleanup, and data disaster recovery.
Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Consulting in Minneapolis
For ransomware system restoration consulting services in the Minneapolis metro area, phone Progent at
Select Topic: